[Zope-Coders] Bug in SecurityPolicy?

[Chris Withers]

Chris Withers wrote:
> This strikes me as wrong. Why? Well, Folders have the equivalent of 
> security.setDefaultAccess("allow") in them. So, surely, the title 
> attribute (which is unprotected by the secrity machinery, 'cos it's a 
> string) should be accessible by an anonymous user with no roles?

Worse still, it appears that as long as the user's current role gives them the 
'View' permission, they can access unprotected subobjects/properties...

cheers,

Chris